On Tuesday 6 October, ASOS customers received a message from their own shopping app that was not meant for them. It was addressed to the company’s data protection officer.
The push notification, titled “ASOS HACKED”, read: “we have fully compromised the Snowflake instance. Engage with us, or we will leak it.” ASOS acknowledged that an unauthorised notification had been sent and told customers to disregard it. A week later, ITV News reported that ASOS said an unauthorised party had accessed some personal data, including names and contact details.
The Snowflake claim has not held up. Snowflake told Infosecurity Magazine on the day that it had found no compromise of its platform, and ITV reported that it later said the breach was not caused by a vulnerability or flaw in its platform.
The delivery method drew the most expert attention. Dan Bird of Horizon3 told the BBC that sending a push notification needs access to a notification system separate from a data platform. If both claims held up, he said, the attackers had “credentials that opened more than one door.” We covered the first reactions on 6 October: [link].
TFG London, a subsidiary of South Africa’s Foschini Group, said it identified a cybersecurity incident on Sunday 11 October affecting some IT systems at its Phase Eight, Hobbs and Whistles brands. Stores are open as normal, it said, though some website capabilities may be unavailable. It said it has no reason to believe payment information is at risk. Inside Story and White Stuff are not affected. TFG reported the incident to the relevant UK authorities, and the ICO said it is assessing the information provided.
The Times reported that H&M is looking into a potential cybersecurity incident after claims by a group called ShinyHunters. H&M is investigating. Nothing in the reports we checked confirms a breach.
Jonathon Ellison, the NCSC’s director for national resilience, said in a LinkedIn post that the NCSC is engaging with the retail sector through its existing trusted networks. He said all organisations, from start-ups to multinationals, must act to strengthen their defences, and urged them to follow the advice on the NCSC website.
TFG’s statement draws a line that retail security teams will recognise: stores trading as normal while parts of the website are down. The NCSC’s new disruptive-attack guidance asks organisations which services matter most and how long they can run without them. Retail gives that question two answers, one for the shop floor and one for the web channel: [link to our NCSC article].
ASOS shows that a company’s own app can carry an attacker’s message. Charlotte Wilson of Check Point told the BBC that attackers appeared to have “turned ASOS’s own app into their ransom note.” Customers trust those notifications because they appear to come from the company. Who can send them, and how that access is secured, is worth asking.
Ade Clewlow of NCC Group put the retail risk in terms of timing. Retailers, he said, are an attractive target as Black Friday and the festive period approach. His checks were basic: know where your data is held, who can access it, and whether your suppliers meet appropriate security standards. The ICO’s rule applies throughout. Organisations must report a personal data breach within 72 hours of becoming aware of it, unless it is unlikely to risk people’s rights and freedoms.
Register your interest for The Security Event 2027
Subscribe to The Security Briefing for monthly updates!